@djangocfg/api 2.1.427 → 2.1.428

package/README.md

@@ -78,6 +78,62 @@ import {
 } from '@djangocfg/api/auth';
 ```
 
+## Token storage & DPoP
+
+The token lives in the shared `auth` store (localStorage by default, switchable
+to cookie):
+
+```typescript
+import { auth } from '@djangocfg/api';
+
+auth.getToken();              // current access token
+auth.setStorageMode('cookie'); // SSR-readable cookie instead of localStorage
+```
+
+### DPoP (RFC 9449) — sender-constrained tokens
+
+When enabled, the generated client holds a **non-extractable** P-256 key
+(IndexedDB) and attaches a fresh `DPoP` proof to every request, so a stolen
+token can't be replayed. No BFF/proxy required.
+
+```typescript
+import { dpopEnabled } from '@djangocfg/api';
+// true when NEXT_PUBLIC_DPOP_ENABLED==='true'
+// (set it via createBaseNextConfig({ dpop: true }) in @djangocfg/nextjs)
+```
+
+Backend pairing: `JWTConfig(dpop_enabled=True)`. Full guide:
+`@djangocfg/nextjs/@docs/DPOP.md`. The token is still readable via
+`auth.getToken()` — DPoP protects by *binding* to the key, not by hiding the token.
+
+## Logging — role-aware verbosity
+
+All `@djangocfg/*` consola loggers read one global runtime level so the console
+is clean for end users and verbose for admins/devs — like big SaaS apps.
+
+```typescript
+import { applyRoleLogPolicy, setLogLevel } from '@djangocfg/api';
+
+// Usually automatic: AuthProvider calls this on login/logout.
+// admin (is_staff/is_superuser) or dev → debug; prod regular user → errors only.
+applyRoleLogPolicy({ isAdmin: user?.is_staff || user?.is_superuser });
+
+// Manual override (0 silent · 1 error · 2 warn · 3 info · 4 debug · 5 trace):
+setLogLevel(0);
+```
+
+Errors still flow to `@djangocfg/monitor` regardless of console level, so prod
+incidents stay diagnosable.
+
+## Env flags
+
+`@djangocfg/api` is the lowest shared package, so env flags live here (single
+source of truth):
+
+```typescript
+import { isDev, isProd, isBrowser, isStaticBuild, dpopEnabled } from '@djangocfg/api';
+```
+
 ## Type Namespaces
 
 ```typescript

package/dist/auth-server.cjs

@@ -342,6 +342,99 @@ async function tryRefresh() {
   return _refreshInflight;
 }
 __name(tryRefresh, "tryRefresh");
+function dpopEnabled() {
+  try {
+    return typeof process !== "undefined" && process.env?.NEXT_PUBLIC_DPOP_ENABLED === "true";
+  } catch {
+    return false;
+  }
+}
+__name(dpopEnabled, "dpopEnabled");
+var _DPOP_DB = "cfg-auth";
+var _DPOP_STORE = "keys";
+var _DPOP_KEY_ID = "dpop-ec-p256";
+function _idbOpen() {
+  return new Promise((resolve, reject) => {
+    const req = indexedDB.open(_DPOP_DB, 1);
+    req.onupgradeneeded = () => req.result.createObjectStore(_DPOP_STORE);
+    req.onsuccess = () => resolve(req.result);
+    req.onerror = () => reject(req.error);
+  });
+}
+__name(_idbOpen, "_idbOpen");
+function _idbGet(key) {
+  return _idbOpen().then((db) => new Promise((resolve, reject) => {
+    const tx = db.transaction(_DPOP_STORE, "readonly");
+    const req = tx.objectStore(_DPOP_STORE).get(key);
+    req.onsuccess = () => resolve(req.result);
+    req.onerror = () => reject(req.error);
+  }));
+}
+__name(_idbGet, "_idbGet");
+function _idbPut(key, value) {
+  return _idbOpen().then((db) => new Promise((resolve, reject) => {
+    const tx = db.transaction(_DPOP_STORE, "readwrite");
+    tx.objectStore(_DPOP_STORE).put(value, key);
+    tx.oncomplete = () => resolve();
+    tx.onerror = () => reject(tx.error);
+  }));
+}
+__name(_idbPut, "_idbPut");
+var _dpopKeyPromise = null;
+function _getDpopKeyPair() {
+  if (_dpopKeyPromise) return _dpopKeyPromise;
+  _dpopKeyPromise = (async () => {
+    const existing = await _idbGet(_DPOP_KEY_ID).catch(() => void 0);
+    if (existing) return existing;
+    const pair = await crypto.subtle.generateKey(
+      { name: "ECDSA", namedCurve: "P-256" },
+      false,
+      // extractable:false — JS can sign but never export the private key
+      ["sign"]
+    );
+    await _idbPut(_DPOP_KEY_ID, pair).catch(() => {
+    });
+    return pair;
+  })();
+  return _dpopKeyPromise;
+}
+__name(_getDpopKeyPair, "_getDpopKeyPair");
+function _b64urlFromBytes(bytes) {
+  const arr = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+  let s = "";
+  for (let i = 0; i < arr.length; i++) s += String.fromCharCode(arr[i]);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+__name(_b64urlFromBytes, "_b64urlFromBytes");
+function _b64urlFromString(str) {
+  return _b64urlFromBytes(new TextEncoder().encode(str));
+}
+__name(_b64urlFromString, "_b64urlFromString");
+async function _publicJwk(pub) {
+  const jwk = await crypto.subtle.exportKey("jwk", pub);
+  return { kty: "EC", crv: "P-256", x: jwk.x, y: jwk.y };
+}
+__name(_publicJwk, "_publicJwk");
+async function _makeDpopProof(method, url) {
+  try {
+    const pair = await _getDpopKeyPair();
+    const jwk = await _publicJwk(pair.publicKey);
+    const header = { typ: "dpop+jwt", alg: "ES256", jwk };
+    const htu = url.split("#")[0].split("?")[0];
+    const jti = crypto.randomUUID && crypto.randomUUID() || _b64urlFromBytes(crypto.getRandomValues(new Uint8Array(16)));
+    const payload = { htm: method.toUpperCase(), htu, iat: Math.floor(Date.now() / 1e3), jti };
+    const signingInput = `${_b64urlFromString(JSON.stringify(header))}.${_b64urlFromString(JSON.stringify(payload))}`;
+    const sig = await crypto.subtle.sign(
+      { name: "ECDSA", hash: "SHA-256" },
+      pair.privateKey,
+      new TextEncoder().encode(signingInput)
+    );
+    return `${signingInput}.${_b64urlFromBytes(sig)}`;
+  } catch {
+    return null;
+  }
+}
+__name(_makeDpopProof, "_makeDpopProof");
 function installAuthOnClient(client2) {
   if (_client) return;
   _client = client2;
@@ -349,7 +442,7 @@ function installAuthOnClient(client2) {
     baseUrl: auth.getBaseUrl(),
     credentials: _withCredentials ? "include" : "same-origin"
   });
-  client2.interceptors.request.use((request) => {
+  client2.interceptors.request.use(async (request) => {
     const token = auth.getToken();
     if (token) request.headers.set("Authorization", `Bearer ${token}`);
     const locale = auth.getLocale();
@@ -362,6 +455,10 @@ function installAuthOnClient(client2) {
     } catch {
     }
     request.headers.set("X-Client-Time", (/* @__PURE__ */ new Date()).toISOString());
+    if (dpopEnabled() && typeof window !== "undefined") {
+      const proof = await _makeDpopProof(request.method, request.url);
+      if (proof) request.headers.set("DPoP", proof);
+    }
     return request;
   });
   client2.interceptors.error.use((err, res, req) => {
@@ -395,6 +492,10 @@ function installAuthOnClient(client2) {
     const retry = request.clone();
     retry.headers.set("Authorization", `Bearer ${newToken}`);
     retry.headers.set(RETRY_MARKER, "1");
+    if (dpopEnabled() && typeof window !== "undefined") {
+      const proof = await _makeDpopProof(retry.method, retry.url);
+      if (proof) retry.headers.set("DPoP", proof);
+    }
     try {
       const retried = await fetch(retry);
       if (retried.status === 401 && _onUnauthorized) {
@@ -1344,7 +1445,11 @@ var CfgAccountsApiKey = class {
   static cfgAccountsApiKeyRetrieve(options) {
     return (options?.client ?? client).get({
       security: [
-        { scheme: "bearer", type: "http" },
+        {
+          key: "jwtAuth",
+          scheme: "bearer",
+          type: "http"
+        },
         {
           in: "cookie",
           name: "sessionid",
@@ -1364,7 +1469,11 @@ var CfgAccountsApiKey = class {
   static cfgAccountsApiKeyRegenerateCreate(options) {
     return (options.client ?? client).post({
       security: [
-        { scheme: "bearer", type: "http" },
+        {
+          key: "jwtAuth",
+          scheme: "bearer",
+          type: "http"
+        },
         {
           in: "cookie",
           name: "sessionid",
@@ -1388,7 +1497,11 @@ var CfgAccountsApiKey = class {
   static cfgAccountsApiKeyTestCreate(options) {
     return (options.client ?? client).post({
       security: [
-        { scheme: "bearer", type: "http" },
+        {
+          key: "jwtAuth",
+          scheme: "bearer",
+          type: "http"
+        },
         {
           in: "cookie",
           name: "sessionid",
@@ -1416,7 +1529,11 @@ var CfgAccountsOauth = class {
    */
   static cfgAccountsOauthConnectionsList(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/oauth/connections/",
       ...options
     });
@@ -1428,7 +1545,11 @@ var CfgAccountsOauth = class {
    */
   static cfgAccountsOauthDisconnectCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/oauth/disconnect/",
       ...options,
       headers: {
@@ -1485,7 +1606,11 @@ var CfgAccounts = class {
    */
   static cfgAccountsOtpRequestCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/otp/request/",
       ...options,
       headers: {
@@ -1506,7 +1631,11 @@ var CfgAccounts = class {
    */
   static cfgAccountsOtpVerifyCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/otp/verify/",
       ...options,
       headers: {
@@ -1527,7 +1656,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfileRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1544,7 +1677,11 @@ var CfgAccountsProfile = class {
   static cfgAccountsProfileAvatarCreate(options) {
     return (options?.client ?? client).post({
       ...formDataBodySerializer,
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/profile/avatar/",
       ...options,
       headers: {
@@ -1570,7 +1707,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfileDeleteCreate(options) {
     return (options?.client ?? client).post({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1586,7 +1727,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfilePartialPartialUpdate(options) {
     return (options?.client ?? client).patch({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1606,7 +1751,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfilePartialUpdate(options) {
     return (options?.client ?? client).put({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1626,7 +1775,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfileUpdatePartialUpdate(options) {
     return (options?.client ?? client).patch({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1646,7 +1799,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfileUpdateUpdate(options) {
     return (options?.client ?? client).put({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1689,7 +1846,11 @@ var CfgCentrifugo = class {
    */
   static cfgCentrifugoAuthTokenRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/centrifugo/auth/token/",
       ...options
     });
@@ -1704,7 +1865,11 @@ var CfgTotpBackupCodes = class {
    */
   static cfgTotpBackupCodesRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/backup-codes/",
       ...options
     });
@@ -1717,7 +1882,11 @@ var CfgTotpBackupCodes = class {
    */
   static cfgTotpBackupCodesRegenerateCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/backup-codes/regenerate/",
       ...options,
       headers: {
@@ -1736,7 +1905,11 @@ var CfgTotp = class {
    */
   static cfgTotpDevicesRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/devices/",
       ...options
     });
@@ -1748,7 +1921,11 @@ var CfgTotp = class {
    */
   static cfgTotpDevicesDestroy(options) {
     return (options.client ?? client).delete({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/devices/{id}/",
       ...options
     });
@@ -1760,7 +1937,11 @@ var CfgTotp = class {
    */
   static cfgTotpDisableCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/disable/",
       ...options,
       headers: {
@@ -1781,7 +1962,11 @@ var CfgTotpSetup = class {
    */
   static cfgTotpSetupCreate(options) {
     return (options?.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/setup/",
       ...options,
       headers: {
@@ -1797,7 +1982,11 @@ var CfgTotpSetup = class {
    */
   static cfgTotpSetupConfirmCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/setup/confirm/",
       ...options,
       headers: {
@@ -1818,7 +2007,11 @@ var CfgTotpVerify = class {
    */
   static cfgTotpVerifyCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/verify/",
       ...options,
       headers: {
@@ -1834,7 +2027,11 @@ var CfgTotpVerify = class {
    */
   static cfgTotpVerifyBackupCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/verify/backup/",
       ...options,
       headers: {
@@ -2049,19 +2246,38 @@ var CfgAccountsApi = new API();
 var CfgCentrifugoApi = new API2();
 var CfgTotpApi = new API3();
 
-// src/auth/utils/logger.ts
-var import_consola2 = require("consola");
-
 // src/auth/utils/env.ts
 var isDev = process.env.NODE_ENV === "development";
+var isStaticBuild = process.env.NEXT_PUBLIC_STATIC_BUILD === "true";
+var dpopEnabled2 = process.env.NEXT_PUBLIC_DPOP_ENABLED === "true";
+
+// src/log-control.ts
+var verboseByDefault = isDev || isStaticBuild;
+var DEFAULT_LEVEL = verboseByDefault ? 4 : 1;
+var _level = DEFAULT_LEVEL;
+var _subscribers = /* @__PURE__ */ new Set();
+function getLogLevel() {
+  return _level;
+}
+__name(getLogLevel, "getLogLevel");
+function onLogLevelChange(fn) {
+  _subscribers.add(fn);
+  try {
+    fn(_level);
+  } catch {
+  }
+  return () => _subscribers.delete(fn);
+}
+__name(onLogLevelChange, "onLogLevelChange");
 
 // src/auth/utils/logger.ts
-var isStaticBuild = process.env.NEXT_PUBLIC_STATIC_BUILD === "true";
-var showLogs = isDev || isStaticBuild;
+var import_consola2 = require("consola");
 var logger = (0, import_consola2.createConsola)({
-  level: showLogs ? 4 : 1
-  // dev: debug, production: errors only
+  level: getLogLevel()
 }).withTag("api");
+onLogLevelChange((level) => {
+  logger.level = level;
+});
 var authLogger = logger.withTag("auth");
 
 // src/auth/middlewares/tokenRefresh.ts